@fjall/components-infrastructure 33.1.0 → 35.0.0

package/dist/lib/resources/aws/messaging/sns.js

@@ -1,7 +1,6 @@
 import { Construct } from "constructs";
 import { CfnOutput } from "aws-cdk-lib";
 import { Topic } from "aws-cdk-lib/aws-sns";
-import { tierDefault } from "../../../utils/backupTierMapping.js";
 import { StackEncryptionKey } from "../secrets/stackEncryptionKey.js";
 import { toRemovalPolicy } from "./utils.js";
 export class SNSTopic extends Construct {
@@ -11,10 +10,11 @@ export class SNSTopic extends Construct {
         super(scope, id);
         this.id = id;
         const isFifo = props.fifo === true;
+        const encryptionOverride = props.encryption === undefined
+            ? undefined
+            : props.encryption === "SSE_KMS";
         const masterKey = props.masterKey ??
-            (tierDefault(props.appBackupTier, "customerManagedKeys")
-                ? StackEncryptionKey.of(this).forSnsServicePublishers()
-                : undefined);
+            StackEncryptionKey.forTier(this, props.appBackupTier, encryptionOverride)?.forSnsServicePublishers();
         const topicName = props.topicName
             ? isFifo
                 ? `${props.topicName}.fifo`

package/dist/lib/resources/aws/networking/vpcPeeringAccepterRole.js

@@ -1,7 +1,8 @@
 import { Construct } from "constructs";
-import { ArnFormat, Stack, Tags } from "aws-cdk-lib";
+import { ArnFormat, Stack } from "aws-cdk-lib";
 import { AccountPrincipal, CompositePrincipal, PolicyDocument, PolicyStatement, Role } from "aws-cdk-lib/aws-iam";
 import { applyCostAllocationTags } from "../../../utils/costAllocationTags.js";
+import { applyResourceTypeTag, FJALL_RESOURCE_TYPES } from "../../../utils/resourceTypeTags.js";
 export class VpcPeeringAccepterRole extends Construct {
     role;
     roleArn;
@@ -53,7 +54,7 @@ export class VpcPeeringAccepterRole extends Construct {
             }
         });
         this.roleArn = this.role.roleArn;
-        Tags.of(this).add("fjall:resource:type", "vpc-peering-accepter");
+        applyResourceTypeTag(this, FJALL_RESOURCE_TYPES.vpcPeeringAccepter);
         applyCostAllocationTags(this, {
             service: "vpcPeeringAccepter",
             domain: props.costAllocationDomain ?? props.localVpc.node.id,

package/dist/lib/resources/aws/networking/vpcPeeringConnection.js

@@ -4,6 +4,7 @@ import { CfnRoute, CfnVPCPeeringConnection, SubnetType } from "aws-cdk-lib/aws-e
 import { PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
 import { applyCostAllocationTags } from "../../../utils/costAllocationTags.js";
+import { applyResourceTypeTag, FJALL_RESOURCE_TYPES } from "../../../utils/resourceTypeTags.js";
 import { AwsCustomResource } from "../utilities/awsCustomResource.js";
 import { CrossAccountReturnRoutes } from "./crossAccountReturnRoutes.js";
 export class VpcPeeringConnection extends Construct {
@@ -92,7 +93,7 @@ export class VpcPeeringConnection extends Construct {
                 enableDns: enableDnsResolution
             });
         }
-        Tags.of(this).add("fjall:resource:type", "vpc-peering");
+        applyResourceTypeTag(this, FJALL_RESOURCE_TYPES.vpcPeering);
         Tags.of(this).add("fjall:peering:peer-vpc", props.peerVpcId);
         if (props.peerAccountId) {
             Tags.of(this).add("fjall:peering:peer-account", props.peerAccountId);

package/dist/lib/resources/aws/secrets/stackEncryptionKey.d.ts

@@ -1,5 +1,6 @@
 import type { IKey } from "aws-cdk-lib/aws-kms";
 import type { Construct } from "constructs";
+import { type BackupTier } from "../../../utils/backupTierMapping.js";
 import { CustomerManagedKey } from "./kms.js";
 /**
  * The one customer-managed KMS key an enterprise-tier stack encrypts its
@@ -16,10 +17,12 @@ import { CustomerManagedKey } from "./kms.js";
  * costs $1–3/month; a destroyed key would render the surviving table
  * permanently unreadable after its 30-day pending window.
  *
- * Grant-based consumers (DynamoDB, Lambda `environmentEncryption`, ECS Exec)
- * read `key` directly — the SDK/CDK grants they need ride the resource's own
- * IAM path. Service-side encryptors need a resource-policy admission first:
- * CloudWatch Logs through [[forLogGroups]], SNS service publishers through
+ * Constructs reach it through [[forTier]] — the one place the tier's
+ * `customerManagedKeys` column is read. Grant-based consumers (DynamoDB,
+ * Lambda `environmentEncryption`, ECS Exec) then read `key` directly — the
+ * SDK/CDK grants they need ride the resource's own IAM path. Service-side
+ * encryptors need a resource-policy admission first: CloudWatch Logs through
+ * [[forLogGroups]], SNS service publishers through
  * [[forSnsServicePublishers]]. Each admission is added once per stack.
  */
 export declare class StackEncryptionKey extends CustomerManagedKey {
@@ -28,6 +31,16 @@ export declare class StackEncryptionKey extends CustomerManagedKey {
     private constructor();
     /** The stack's shared key, created on first use. */
     static of(scope: Construct): StackEncryptionKey;
+    /**
+     * The stack's shared key when the tier's `customerManagedKeys` column says
+     * so, else `undefined` — the one place the column is read. A resource with
+     * its own encryption vocabulary (DynamoDB `encryption`, SNS `encryption`)
+     * passes the explicit choice as `override`; `undefined` lets the tier
+     * decide. The key is only created when the answer is yes, so an opt-out at
+     * enterprise mints nothing and an opt-in below enterprise mints the shared
+     * key rather than a per-resource one.
+     */
+    static forTier(scope: Construct, tier: BackupTier | undefined, override?: boolean): StackEncryptionKey | undefined;
     /**
      * The key, with CloudWatch Logs admitted to it. The CDK `LogGroup` sets
      * `KmsKeyId` but adds no key-policy statement, and without one the

package/dist/lib/resources/aws/secrets/stackEncryptionKey.js

@@ -1,5 +1,6 @@
 import { Stack } from "aws-cdk-lib";
 import { PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { tierDefault } from "../../../utils/backupTierMapping.js";
 import { CustomerManagedKey } from "./kms.js";
 const STACK_ENCRYPTION_KEY_ID = "FjallStackEncryptionKey";
 /**
@@ -33,10 +34,12 @@ const SNS_SERVICE_PUBLISHERS = [
  * costs $1–3/month; a destroyed key would render the surviving table
  * permanently unreadable after its 30-day pending window.
  *
- * Grant-based consumers (DynamoDB, Lambda `environmentEncryption`, ECS Exec)
- * read `key` directly — the SDK/CDK grants they need ride the resource's own
- * IAM path. Service-side encryptors need a resource-policy admission first:
- * CloudWatch Logs through [[forLogGroups]], SNS service publishers through
+ * Constructs reach it through [[forTier]] — the one place the tier's
+ * `customerManagedKeys` column is read. Grant-based consumers (DynamoDB,
+ * Lambda `environmentEncryption`, ECS Exec) then read `key` directly — the
+ * SDK/CDK grants they need ride the resource's own IAM path. Service-side
+ * encryptors need a resource-policy admission first: CloudWatch Logs through
+ * [[forLogGroups]], SNS service publishers through
  * [[forSnsServicePublishers]]. Each admission is added once per stack.
  */
 export class StackEncryptionKey extends CustomerManagedKey {
@@ -59,6 +62,19 @@ export class StackEncryptionKey extends CustomerManagedKey {
             return existing;
         return new StackEncryptionKey(stack);
     }
+    /**
+     * The stack's shared key when the tier's `customerManagedKeys` column says
+     * so, else `undefined` — the one place the column is read. A resource with
+     * its own encryption vocabulary (DynamoDB `encryption`, SNS `encryption`)
+     * passes the explicit choice as `override`; `undefined` lets the tier
+     * decide. The key is only created when the answer is yes, so an opt-out at
+     * enterprise mints nothing and an opt-in below enterprise mints the shared
+     * key rather than a per-resource one.
+     */
+    static forTier(scope, tier, override) {
+        const onStackKey = override ?? tierDefault(tier, "customerManagedKeys");
+        return onStackKey ? StackEncryptionKey.of(scope) : undefined;
+    }
     /**
      * The key, with CloudWatch Logs admitted to it. The CDK `LogGroup` sets
      * `KmsKeyId` but adds no key-policy statement, and without one the

package/dist/lib/resources/aws/storage/bucketDeployment.d.ts

@@ -8,6 +8,11 @@ import { type Construct } from "constructs";
  * service-auto-created. Per the Wrapper Routing Discipline rule (generator
  * standards) and the infrastructure wrapper-routing pattern (§ A3), `lib/{config,
  * patterns}/` MUST instantiate this class rather than the raw CDK construct.
+ *
+ * The handler is a deploy-time writer: aws-cdk-lib hoists its function and
+ * execution role to the stack scope under an id that embeds a per-variant
+ * uuid (memory, VPC, ephemeral storage), so the role is marked through the
+ * public `handlerRole` seam rather than by construct id.
  */
 export declare class BucketDeployment extends CdkBucketDeployment {
     constructor(scope: Construct, id: string, props: BucketDeploymentProps);

package/dist/lib/resources/aws/storage/bucketDeployment.js

@@ -1,4 +1,5 @@
 import { BucketDeployment as CdkBucketDeployment } from "aws-cdk-lib/aws-s3-deployment";
+import { markDeployTimeWriter } from "../../../utils/resourceTypeTags.js";
 import { stackSingletonLogGroup } from "../logging/singletonLogGroup.js";
 /**
  * Routing-point wrapper for `aws-cdk-lib/aws-s3-deployment.BucketDeployment`.
@@ -8,6 +9,11 @@ import { stackSingletonLogGroup } from "../logging/singletonLogGroup.js";
  * service-auto-created. Per the Wrapper Routing Discipline rule (generator
  * standards) and the infrastructure wrapper-routing pattern (§ A3), `lib/{config,
  * patterns}/` MUST instantiate this class rather than the raw CDK construct.
+ *
+ * The handler is a deploy-time writer: aws-cdk-lib hoists its function and
+ * execution role to the stack scope under an id that embeds a per-variant
+ * uuid (memory, VPC, ephemeral storage), so the role is marked through the
+ * public `handlerRole` seam rather than by construct id.
  */
 export class BucketDeployment extends CdkBucketDeployment {
     constructor(scope, id, props) {
@@ -19,5 +25,6 @@ export class BucketDeployment extends CdkBucketDeployment {
             // site instantiates first.
             logGroup: props.logGroup ?? stackSingletonLogGroup(scope, "BucketDeployment")
         });
+        markDeployTimeWriter(this.handlerRole);
     }
 }

package/dist/lib/resources/aws/storage/s3.d.ts

@@ -68,7 +68,8 @@ export interface S3BucketProps extends BucketProps {
      * `S3_VERSIONING_DISABLED` finding `mitigated` rather than `open` on
      * buckets whose contents are rebuilt, not kept. Constructs pass it for the
      * buckets they own (Payload build output and ISR cache, ClickHouse cold
-     * tier); an author may pass it for a disposable bucket of their own.
+     * tier, the stack access-log bucket); an author may pass it for a
+     * disposable bucket of their own.
      */
     versioningExemption?: S3VersioningExemption;
     publicReadAccess?: boolean;

package/dist/lib/resources/aws/utilities/awsCustomResource.d.ts

@@ -1,5 +1,14 @@
 import * as customResource from "aws-cdk-lib/custom-resources";
 import { type Construct } from "constructs";
+/**
+ * The stack-scope construct id under which aws-cdk-lib hoists the one
+ * `AwsCustomResource` provider every site in a stack shares: the singleton's
+ * `lambdaPurpose` ("AWS") followed by its uuid with the hyphens stripped —
+ * `SingletonFunction.constructName`'s derivation, from the public
+ * `PROVIDER_FUNCTION_UUID`. Test fixtures address the hoisted function and
+ * its execution role by this prefix.
+ */
+export declare const AWS_CUSTOM_RESOURCE_PROVIDER_ID: string;
 export declare class AwsCustomResource extends customResource.AwsCustomResource {
     readonly response: string;
     constructor(scope: Construct, id: string, props: customResource.AwsCustomResourceProps);

package/dist/lib/resources/aws/utilities/awsCustomResource.js

@@ -1,5 +1,16 @@
+import { Stack } from "aws-cdk-lib";
 import * as customResource from "aws-cdk-lib/custom-resources";
+import { markDeployTimeWriter } from "../../../utils/resourceTypeTags.js";
 import { stackSingletonLogGroup } from "../logging/singletonLogGroup.js";
+/**
+ * The stack-scope construct id under which aws-cdk-lib hoists the one
+ * `AwsCustomResource` provider every site in a stack shares: the singleton's
+ * `lambdaPurpose` ("AWS") followed by its uuid with the hyphens stripped —
+ * `SingletonFunction.constructName`'s derivation, from the public
+ * `PROVIDER_FUNCTION_UUID`. Test fixtures address the hoisted function and
+ * its execution role by this prefix.
+ */
+export const AWS_CUSTOM_RESOURCE_PROVIDER_ID = `AWS${customResource.AwsCustomResource.PROVIDER_FUNCTION_UUID.replace(/[^a-zA-Z0-9]/g, "")}`;
 export class AwsCustomResource extends customResource.AwsCustomResource {
     response;
     constructor(scope, id, props) {
@@ -14,5 +25,10 @@ export class AwsCustomResource extends customResource.AwsCustomResource {
                     resources: customResource.AwsCustomResourcePolicy.ANY_RESOURCE
                 })
         });
+        // aws-cdk-lib hoists the shared provider — and, unless the site passed
+        // `role`, its execution role — to the stack scope, out of reach of any
+        // tag on this construct. `findChild` throws if the hoist ever moves, so a
+        // CDK upgrade that would silently un-mark the role fails at synth.
+        markDeployTimeWriter(Stack.of(this).node.findChild(AWS_CUSTOM_RESOURCE_PROVIDER_ID));
     }
 }

package/dist/lib/resources/aws/utilities/customResource.js

@@ -5,6 +5,7 @@ import { Construct } from "constructs";
 import { SingletonFunction, LambdaFunction } from "../compute/lambda.js";
 import { DEFAULT_CUSTOM_RESOURCE_TIMEOUT_SECONDS } from "../compute/ecsConstants.js";
 import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "../logging/logGroup.js";
+import { markDeployTimeWriter } from "../../../utils/resourceTypeTags.js";
 export class CustomResource extends Construct {
     response;
     resource;
@@ -71,5 +72,6 @@ export class CustomResource extends Construct {
             })
         });
         this.response = this.resource.getAtt("Response").toString();
+        markDeployTimeWriter(this);
     }
 }

package/dist/lib/resources/aws/utilities/customResourceProvider.d.ts

@@ -1,5 +1,11 @@
 import { Provider, type ProviderProps } from "aws-cdk-lib/custom-resources";
 import { type Construct } from "constructs";
+/**
+ * Routing-point wrapper for the custom-resource provider framework. The
+ * framework's onEvent/isComplete functions and their roles are deploy-time
+ * writers; the caller's own handler (`props.onEventHandler`) lives outside
+ * this scope and is the caller's to mark.
+ */
 export declare class CustomResourceProvider extends Provider {
     constructor(scope: Construct, id: string, props: ProviderProps);
 }

package/dist/lib/resources/aws/utilities/customResourceProvider.js

@@ -1,6 +1,14 @@
 import { Provider } from "aws-cdk-lib/custom-resources";
+import { markDeployTimeWriter } from "../../../utils/resourceTypeTags.js";
+/**
+ * Routing-point wrapper for the custom-resource provider framework. The
+ * framework's onEvent/isComplete functions and their roles are deploy-time
+ * writers; the caller's own handler (`props.onEventHandler`) lives outside
+ * this scope and is the caller's to mark.
+ */
 export class CustomResourceProvider extends Provider {
     constructor(scope, id, props) {
         super(scope, id, props);
+        markDeployTimeWriter(this);
     }
 }

package/dist/lib/utils/deployTimeWriterMarkerAspect.d.ts

@@ -0,0 +1,23 @@
+import { type IAspect } from "aws-cdk-lib";
+import type { IConstruct } from "constructs";
+/**
+ * Marks the execution roles aws-cdk-lib's lightweight custom-resource
+ * provider framework (`CustomResourceProviderBase`) renders as raw
+ * `AWS::IAM::Role` CfnResources: `Custom::VpcRestrictDefaultSG` under the
+ * `@aws-cdk/aws-ec2:restrictDefaultSecurityGroup` flag every scaffolded
+ * `cdk.json` sets, `Custom::CrossAccountZoneDelegation`, and whichever the
+ * next CDK release adds. Those roles have no tag manager, so `Tags.of()` —
+ * the wrappers' mechanism — never reaches them; this aspect writes the marker
+ * as a property override instead. Registered once per `App`, so every stack
+ * gets it without a per-construct site to forget.
+ *
+ * Recognised structurally, not by construct id: a `Role` CfnResource whose
+ * parent exposes the framework's `serviceToken` + `roleArn` pair. Prototype
+ * probing rather than `instanceof`, for the duplicate-aws-cdk-lib reason
+ * `logGroupHygiene` records. The full `Provider` framework exposes no
+ * `roleArn` and builds L2 roles, so it is not matched here — its wrappers tag
+ * it directly.
+ */
+export declare class DeployTimeWriterMarkerAspect implements IAspect {
+    visit(node: IConstruct): void;
+}

package/dist/lib/utils/deployTimeWriterMarkerAspect.js

@@ -0,0 +1,35 @@
+import { CfnResource } from "aws-cdk-lib";
+import { markDeployTimeWriterCfn } from "./resourceTypeTags.js";
+/**
+ * Marks the execution roles aws-cdk-lib's lightweight custom-resource
+ * provider framework (`CustomResourceProviderBase`) renders as raw
+ * `AWS::IAM::Role` CfnResources: `Custom::VpcRestrictDefaultSG` under the
+ * `@aws-cdk/aws-ec2:restrictDefaultSecurityGroup` flag every scaffolded
+ * `cdk.json` sets, `Custom::CrossAccountZoneDelegation`, and whichever the
+ * next CDK release adds. Those roles have no tag manager, so `Tags.of()` —
+ * the wrappers' mechanism — never reaches them; this aspect writes the marker
+ * as a property override instead. Registered once per `App`, so every stack
+ * gets it without a per-construct site to forget.
+ *
+ * Recognised structurally, not by construct id: a `Role` CfnResource whose
+ * parent exposes the framework's `serviceToken` + `roleArn` pair. Prototype
+ * probing rather than `instanceof`, for the duplicate-aws-cdk-lib reason
+ * `logGroupHygiene` records. The full `Provider` framework exposes no
+ * `roleArn` and builds L2 roles, so it is not matched here — its wrappers tag
+ * it directly.
+ */
+export class DeployTimeWriterMarkerAspect {
+    visit(node) {
+        if (!CfnResource.isCfnResource(node) ||
+            node.cfnResourceType !== "AWS::IAM::Role") {
+            return;
+        }
+        const parent = node.node.scope;
+        if (parent === undefined || !isLightweightProvider(parent))
+            return;
+        markDeployTimeWriterCfn(node);
+    }
+}
+function isLightweightProvider(construct) {
+    return "serviceToken" in construct && "roleArn" in construct;
+}

package/dist/lib/utils/resourceTypeTags.d.ts

@@ -0,0 +1,41 @@
+import { FJALL_RESOURCE_TYPE_TAG_KEY, FJALL_RESOURCE_TYPES, type FjallResourceType } from "@fjall/util/aws";
+import { type CfnResource } from "aws-cdk-lib";
+import type { IConstruct } from "constructs";
+export { FJALL_RESOURCE_TYPE_TAG_KEY, FJALL_RESOURCE_TYPES, type FjallResourceType };
+/**
+ * Stamp the `fjall:resource:type` marker on a construct subtree. The marker
+ * answers "what IS this resource" for resources whose physical name is
+ * CloudFormation-generated, so a consumer never has to pattern-match a name.
+ */
+export declare function applyResourceTypeTag(scope: IConstruct, resourceType: FjallResourceType): void;
+/**
+ * Mark a deploy-time-only writer subtree — the execution role CloudFormation
+ * assumes while driving a custom resource, plus the handler, the provider
+ * framework function and their log groups.
+ *
+ * Every writer producer in the library routes through one of two mechanisms,
+ * nothing stamping the key by hand:
+ *
+ * - this helper, called by each wrapper that constructs a writer: the shared
+ *   `CustomResource` utility and the `CustomResourceProvider` wrapper (their
+ *   own subtree), the `SingletonFunction`, `AwsCustomResource` and
+ *   `BucketDeployment` wrappers (the function and role aws-cdk-lib hoists to
+ *   the stack scope, out of reach of any tag on the wrapper itself), the
+ *   identity-store user provider, and the Identity Centre ListInstances role;
+ * - `DeployTimeWriterMarkerAspect` (registered by `App`), for the execution
+ *   roles aws-cdk-lib's lightweight provider framework renders as raw
+ *   CfnResources — `Tags.of()` cannot reach those, so the marker goes on as a
+ *   property override via `markDeployTimeWriterCfn`.
+ *
+ * The producer set is enumerated from source by
+ * `__tests__/deployTimeWriterCensus.test.ts`: a new construction of a CDK
+ * writer class fails that test until it names the mechanism that marks it.
+ */
+export declare function markDeployTimeWriter(scope: IConstruct): void;
+/**
+ * The raw-CfnResource twin of `markDeployTimeWriter`, for a role the
+ * lightweight `CustomResourceProviderBase` framework renders without a tag
+ * manager: the marker is written straight into the resource's `Tags`
+ * property. Called only by `DeployTimeWriterMarkerAspect`.
+ */
+export declare function markDeployTimeWriterCfn(role: CfnResource): void;

package/dist/lib/utils/resourceTypeTags.js

@@ -0,0 +1,54 @@
+import { FJALL_RESOURCE_TYPE_TAG_KEY, FJALL_RESOURCE_TYPES } from "@fjall/util/aws";
+import { Tags } from "aws-cdk-lib";
+// Canonical home: @fjall/util (`util/src/aws/infraTags.ts`) — shared with the
+// Quick-Create template's hand-written twin and the webapp posture exclusion.
+// Re-exported here so construct-package consumers keep one import path.
+export { FJALL_RESOURCE_TYPE_TAG_KEY, FJALL_RESOURCE_TYPES };
+/**
+ * Stamp the `fjall:resource:type` marker on a construct subtree. The marker
+ * answers "what IS this resource" for resources whose physical name is
+ * CloudFormation-generated, so a consumer never has to pattern-match a name.
+ */
+export function applyResourceTypeTag(scope, resourceType) {
+    Tags.of(scope).add(FJALL_RESOURCE_TYPE_TAG_KEY, resourceType);
+}
+/**
+ * Mark a deploy-time-only writer subtree — the execution role CloudFormation
+ * assumes while driving a custom resource, plus the handler, the provider
+ * framework function and their log groups.
+ *
+ * Every writer producer in the library routes through one of two mechanisms,
+ * nothing stamping the key by hand:
+ *
+ * - this helper, called by each wrapper that constructs a writer: the shared
+ *   `CustomResource` utility and the `CustomResourceProvider` wrapper (their
+ *   own subtree), the `SingletonFunction`, `AwsCustomResource` and
+ *   `BucketDeployment` wrappers (the function and role aws-cdk-lib hoists to
+ *   the stack scope, out of reach of any tag on the wrapper itself), the
+ *   identity-store user provider, and the Identity Centre ListInstances role;
+ * - `DeployTimeWriterMarkerAspect` (registered by `App`), for the execution
+ *   roles aws-cdk-lib's lightweight provider framework renders as raw
+ *   CfnResources — `Tags.of()` cannot reach those, so the marker goes on as a
+ *   property override via `markDeployTimeWriterCfn`.
+ *
+ * The producer set is enumerated from source by
+ * `__tests__/deployTimeWriterCensus.test.ts`: a new construction of a CDK
+ * writer class fails that test until it names the mechanism that marks it.
+ */
+export function markDeployTimeWriter(scope) {
+    applyResourceTypeTag(scope, FJALL_RESOURCE_TYPES.deployTimeWriter);
+}
+/**
+ * The raw-CfnResource twin of `markDeployTimeWriter`, for a role the
+ * lightweight `CustomResourceProviderBase` framework renders without a tag
+ * manager: the marker is written straight into the resource's `Tags`
+ * property. Called only by `DeployTimeWriterMarkerAspect`.
+ */
+export function markDeployTimeWriterCfn(role) {
+    role.addPropertyOverride("Tags", [
+        {
+            Key: FJALL_RESOURCE_TYPE_TAG_KEY,
+            Value: FJALL_RESOURCE_TYPES.deployTimeWriter
+        }
+    ]);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "33.1.0",
+  "version": "35.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -39,7 +39,8 @@
     "clean": "rm -rf ./dist",
     "clean:node": "rm -rf ./node_modules",
     "build:cert-gen-lambda": "node lib/lambda-assets/cert-generator/src/build.mjs",
-    "build": "npm run clean && npm run build:cert-gen-lambda && tsc && cp -r lib/layers dist/lib/layers && mkdir -p dist/lib/lambda-assets/cert-generator/asset && cp lib/lambda-assets/cert-generator/asset/index.js dist/lib/lambda-assets/cert-generator/asset/index.js && cp lib/lambda-assets/cert-generator/asset/package.json dist/lib/lambda-assets/cert-generator/asset/package.json && mkdir -p dist/lib/lambda-assets/identity-store-user/asset && cp lib/lambda-assets/identity-store-user/asset/index.js dist/lib/lambda-assets/identity-store-user/asset/index.js && cp lib/lambda-assets/identity-store-user/asset/package.json dist/lib/lambda-assets/identity-store-user/asset/package.json && mkdir -p dist/lib/lambda-assets/static-site-forms/asset && cp lib/lambda-assets/static-site-forms/asset/index.js dist/lib/lambda-assets/static-site-forms/asset/index.js && cp lib/lambda-assets/static-site-forms/asset/package.json dist/lib/lambda-assets/static-site-forms/asset/package.json && cp lib/resources/aws/compute/lifecycleHookLambda.source.cjs dist/lib/resources/aws/compute/lifecycleHookLambda.source.cjs && cp lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs dist/lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs && cp lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs dist/lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs && cp lib/patterns/aws/devSubstrate.waker.source.cjs dist/lib/patterns/aws/devSubstrate.waker.source.cjs && node ../../scripts/stamp-build.mjs",
+    "build": "node ../../scripts/run-build.mjs --purpose=build -- npm run build:steps",
+    "build:steps": "npm run clean && npm run build:cert-gen-lambda && tsc && cp -r lib/layers dist/lib/layers && mkdir -p dist/lib/lambda-assets/cert-generator/asset && cp lib/lambda-assets/cert-generator/asset/index.js dist/lib/lambda-assets/cert-generator/asset/index.js && cp lib/lambda-assets/cert-generator/asset/package.json dist/lib/lambda-assets/cert-generator/asset/package.json && mkdir -p dist/lib/lambda-assets/identity-store-user/asset && cp lib/lambda-assets/identity-store-user/asset/index.js dist/lib/lambda-assets/identity-store-user/asset/index.js && cp lib/lambda-assets/identity-store-user/asset/package.json dist/lib/lambda-assets/identity-store-user/asset/package.json && mkdir -p dist/lib/lambda-assets/static-site-forms/asset && cp lib/lambda-assets/static-site-forms/asset/index.js dist/lib/lambda-assets/static-site-forms/asset/index.js && cp lib/lambda-assets/static-site-forms/asset/package.json dist/lib/lambda-assets/static-site-forms/asset/package.json && cp lib/resources/aws/compute/lifecycleHookLambda.source.cjs dist/lib/resources/aws/compute/lifecycleHookLambda.source.cjs && cp lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs dist/lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs && cp lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs dist/lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs && cp lib/patterns/aws/devSubstrate.waker.source.cjs dist/lib/patterns/aws/devSubstrate.waker.source.cjs && node ../../scripts/stamp-build.mjs",
     "prepack": "node ../../scripts/check-dist-freshness.mjs",
     "prepublishOnly": "node ../../scripts/audit-package-tarball.mjs",
     "watch": "tsc -w",
@@ -79,8 +80,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^33.1.0",
-    "@fjall/util": "^33.1.0",
+    "@fjall/generator": "^35.0.0",
+    "@fjall/util": "^35.0.0",
     "constructs": "^10.7.2",
     "zod": "^4.4.3"
   },